WEBVTT NOTE This file was generated by Descript 00:00:00.060 --> 00:00:01.980 Samantha: Hello, this is Samantha Shares. 00:00:02.580 --> 00:00:05.900 This episode covers the O C C’s Semi-annual Risk 00:00:05.900 --> 00:00:07.990 Perspective, Trends In Key Risks. 00:00:08.364 --> 00:00:11.564 The following is an audio version of that section of the report. 00:00:12.014 --> 00:00:15.194 This podcast is educational and is not legal advice. 00:00:15.584 --> 00:00:19.534 We are sponsored by Credit Union Exam Solutions Incorporated, whose 00:00:19.534 --> 00:00:22.614 team has over two hundred and Forty years of National Credit 00:00:22.614 --> 00:00:24.544 Union Administration experience. 00:00:24.954 --> 00:00:28.614 We assist our clients with N C U A so they save time and money. 00:00:29.084 --> 00:00:33.004 If you are worried about a recent, upcoming or in process N C U A 00:00:33.004 --> 00:00:37.334 examination, reach out to learn how they can assist at Mark Treichel DOT COM. 00:00:37.714 --> 00:00:42.054 Also check out our other podcast called With Flying Colors where we provide tips 00:00:42.054 --> 00:00:44.644 on how to achieve success with N C U A. 00:00:45.035 --> 00:00:48.515 The office of the Comptroller of Currency – the O C C issues 00:00:48.555 --> 00:00:50.535 a semi-annual Risk Perspective. 00:00:51.105 --> 00:00:55.835 This past December’s report has many key sections and today’s podcast highlights 00:00:55.835 --> 00:00:57.975 the section called Trends in Key Risks 00:00:58.400 --> 00:00:59.400 And now the report. 00:00:59.770 --> 00:01:00.060 A. 00:01:00.420 --> 00:01:01.220 Credit Risk. 00:01:01.660 --> 00:01:03.040 COMMERCIAL CREDIT THEMES. 00:01:03.493 --> 00:01:06.433 Commercial credit risk remains moderate and increasing. 00:01:06.933 --> 00:01:09.983 While recessionary pressures are easing, the consensus among 00:01:09.983 --> 00:01:11.533 economists is that the U.S. 00:01:11.773 --> 00:01:16.073 economy will experience slowing growth, which will affect vulnerable borrowers. 00:01:16.573 --> 00:01:20.353 Inflation remains elevated, and many economists predict that interest 00:01:20.353 --> 00:01:22.303 rates will remain higher for longer. 00:01:22.903 --> 00:01:27.303 Wages remain a primary cost driver, and companies in the service industries are 00:01:27.303 --> 00:01:29.783 the most affected by higher labor costs. 00:01:30.163 --> 00:01:33.893 Operating margin deterioration is particularly evident in senior 00:01:33.893 --> 00:01:37.663 living and health care facilities, which are experiencing both wage 00:01:37.663 --> 00:01:39.653 inflation and staffing shortages. 00:01:40.133 --> 00:01:43.913 Elevated interest rates also continue to have an adverse impact on some 00:01:43.913 --> 00:01:46.303 companies’ profit margins and cash flow. 00:01:46.873 --> 00:01:50.603 The companies most affected are those with high leverage and marginal repayment 00:01:50.603 --> 00:01:55.573 capacity, smaller and lower-rated firms with shorter debt maturities, firms with 00:01:55.573 --> 00:02:00.083 a higher level of floating debt, and firms with limited financial flexibility. 00:02:00.403 --> 00:02:03.713 An obligor on a maturing loan with a balloon payment will likely need 00:02:03.713 --> 00:02:07.693 to demonstrate a higher repayment capacity at renewal or refinance due 00:02:07.693 --> 00:02:11.603 to higher debt costs and, for CRE loans, lower property values could 00:02:11.603 --> 00:02:13.643 also lead to the need for re-margining. 00:02:14.103 --> 00:02:16.613 Renewed loans should be appropriately risk-rated. 00:02:17.133 --> 00:02:20.813 The liberal use of extensions and renewals could mask credit weaknesses 00:02:20.983 --> 00:02:24.803 and obscure a borrower’s inability to meet reasonable repayment terms. 00:02:25.293 --> 00:02:28.843 Generally, risk ratings are driven by the strength of the primary source 00:02:28.843 --> 00:02:32.803 of repayment rather than collateral value or strength of guarantor. 00:02:33.268 --> 00:02:36.608 The Federal Reserve has not ruled out additional federal funds rate 00:02:36.608 --> 00:02:38.988 hikes if inflation remains elevated. 00:02:39.438 --> 00:02:42.988 Manufacturing production and new order indexes are declining. 00:02:43.448 --> 00:02:46.618 Further rate hikes would continue to increase the cost of business 00:02:46.618 --> 00:02:50.568 investment and consumer goods, placing downward pressure on demand. 00:02:51.098 --> 00:02:54.668 Demand-side shocks for industries and companies already under stress 00:02:54.668 --> 00:02:58.318 from high input costs or higher interest rates create the potential 00:02:58.318 --> 00:03:02.198 for a rapid and sustained decline in cash flow and profitability. 00:03:02.448 --> 00:03:05.608 The sustained period of price increases will likely serve as a 00:03:05.608 --> 00:03:09.988 drag on revenues for a wide range of industries, particularly growth-dependent 00:03:09.988 --> 00:03:13.488 borrowers and industries that are dependent on consumer discretionary 00:03:13.488 --> 00:03:17.658 spending, if consumers significantly curtail spending across the board. 00:03:18.227 --> 00:03:22.927 Credit quality metrics for C R E in some markets show signs of deterioration 00:03:22.977 --> 00:03:26.707 as persistent headwinds threaten asset quality and loan performance. 00:03:27.077 --> 00:03:32.027 C R E concentrations increased steadily over the past 18 months, and refinance 00:03:32.057 --> 00:03:36.497 risk is heightened due to higher debt costs and increases in operating expenses. 00:03:36.977 --> 00:03:41.357 Expenses, including utilities, property insurance, and taxes, are rising. 00:03:41.797 --> 00:03:46.247 Increasing debt costs are driven by higher interest rates and lower valuations. 00:03:46.647 --> 00:03:51.647 In June 2023, the O C C, the Federal Reserve, Federal Deposit Insurance 00:03:51.647 --> 00:03:56.007 Corporation, and National Credit Union Administration published the “Policy 00:03:56.007 --> 00:04:00.147 Statement on Prudent Commercial Real Estate Loan Accommodations and Workouts.” 00:04:00.947 --> 00:04:05.507 The final interagency policy statement updates and builds on existing interagency 00:04:05.507 --> 00:04:10.167 guidance on C R E loan workouts calling for banks to work prudently and 00:04:10.167 --> 00:04:14.207 constructively with creditworthy borrowers during times of financial stress. 00:04:14.598 --> 00:04:17.588 Risk in the office market remains high and is expanding 00:04:17.588 --> 00:04:19.458 beyond urban business districts. 00:04:19.818 --> 00:04:23.348 Although risk remains highest in urban core markets, vacancy rates 00:04:23.348 --> 00:04:25.418 are rising for suburban submarkets. 00:04:25.878 --> 00:04:29.698 Data suggest that the office sector is experiencing significant structural 00:04:29.698 --> 00:04:33.428 shifts that could take several years to fully materialize as new remote 00:04:33.428 --> 00:04:37.548 work practices normalize and office loans made before 20 20 mature. 00:04:38.048 --> 00:04:41.578 Leases reflect smaller footprints for businesses as tenants seek 00:04:41.578 --> 00:04:43.378 less square footage per employee. 00:04:43.878 --> 00:04:45.418 There is some resiliency in 00:04:45.986 --> 00:04:50.286 5-star and newer buildings, but these leases often include concessions and, 00:04:50.286 --> 00:04:54.386 because of low demand, could negatively affect less well-situated properties. 00:04:54.766 --> 00:04:58.576 Retail and other small business real estate in urban business districts 00:04:58.606 --> 00:05:02.856 that are reliant on office worker foot traffic have higher and rising vacancy 00:05:02.856 --> 00:05:04.996 rates than suburban submarket peers. 00:05:05.473 --> 00:05:09.003 Risk in the multifamily market is increasing, with higher vacancy 00:05:09.003 --> 00:05:12.673 levels due to a combination of new inventory and slowing demand. 00:05:13.213 --> 00:05:16.153 Mortgage delinquencies for multifamily properties remain 00:05:16.153 --> 00:05:18.063 low but are starting to increase. 00:05:18.573 --> 00:05:23.053 Multifamily real estate risk varies by market, property type, and other factors. 00:05:23.573 --> 00:05:27.103 Senior housing continues to struggle as health care worker shortages 00:05:27.103 --> 00:05:29.463 exacerbate real estate risk factors. 00:05:29.833 --> 00:05:33.793 Some parts of the United States, such as Phoenix and Salt Lake City, are 00:05:33.793 --> 00:05:37.753 experiencing an overbuild in luxury properties, which leads to further 00:05:37.753 --> 00:05:39.843 devaluation for older properties. 00:05:40.346 --> 00:05:44.206 Other C R E markets remain sound but show signs of softening. 00:05:44.736 --> 00:05:49.306 The industrial market, which has been the best performing C R E segment, is also 00:05:49.306 --> 00:05:51.476 starting to exhibit some signs of slowing. 00:05:51.946 --> 00:05:56.186 Overall industrial vacancy rates remain low, and it is uncertain whether the 00:05:56.186 --> 00:06:00.146 market is reaching an inflection point or reverting to a normalized level. 00:06:00.626 --> 00:06:04.436 Just as with other C R E property types, however, rising interest 00:06:04.436 --> 00:06:08.536 rates will have a negative impact on cash flows and valuations and will 00:06:08.536 --> 00:06:10.616 increase project financing costs. 00:06:11.116 --> 00:06:14.056 While some retail property types have stabilized, regional 00:06:14.056 --> 00:06:15.536 malls continue to struggle. 00:06:16.047 --> 00:06:19.397 A heightened risk environment could strain the resources of credit risk 00:06:19.397 --> 00:06:21.517 review and loan workout functions. 00:06:21.947 --> 00:06:25.097 Retirements and other attrition, coupled with an extended benign 00:06:25.097 --> 00:06:28.757 credit period, have decreased the number of bankers with problem loan 00:06:28.757 --> 00:06:31.207 identification and mitigation experience. 00:06:31.717 --> 00:06:35.257 Credit risk review functions may need to adjust sampling methodologies 00:06:35.257 --> 00:06:38.997 to capture higher risk industries or segments, borrowers who become 00:06:38.997 --> 00:06:43.427 constrained under stress test scenarios, or borrowers who exhibited marginal 00:06:43.427 --> 00:06:47.867 repayment capacity at origination or during stronger economic conditions. 00:06:48.197 --> 00:06:51.667 Workout functions could experience quickly increasing workloads that 00:06:51.667 --> 00:06:53.677 warrant additional experienced staff. 00:06:54.177 --> 00:06:58.317 Regardless of whether problem loans are part of a formal loan workout, accurate 00:06:58.317 --> 00:07:03.127 and timely risk ratings are a key factor in successful credit risk management and 00:07:03.127 --> 00:07:05.427 are critical for problem loan mitigation. 00:07:05.857 --> 00:07:07.207 RETAIL CREDIT THEMES. 00:07:07.667 --> 00:07:11.187 Retail credit performance remains satisfactory and has largely 00:07:11.187 --> 00:07:13.587 normalized across all asset classes. 00:07:14.027 --> 00:07:17.197 Lagging asset quality indicators have largely returned to 00:07:17.277 --> 00:07:20.987 pre-pandemic levels and remain in line with long-term averages. 00:07:21.387 --> 00:07:25.257 Portfolio growth moderated, with banks reported to have tightened underwriting 00:07:25.257 --> 00:07:29.897 standards earlier in 2023 in response to uncertain economic forecasts. 00:07:30.247 --> 00:07:34.247 Credit risk, including rising credit card and auto delinquencies, is 00:07:34.247 --> 00:07:36.147 moderate and remains manageable. 00:07:36.547 --> 00:07:40.597 Effective risk management practices, including stronger residential real 00:07:40.597 --> 00:07:44.547 estate underwriting since the Great Recession and the low rate refinancings 00:07:44.547 --> 00:07:48.387 done during the pandemic, will support homeowners’ repayment ability 00:07:48.437 --> 00:07:52.177 and better position banks to manage through current economic challenges. 00:07:52.702 --> 00:07:57.192 The strong labor market, rising wages, manageable debt levels, and elevated, 00:07:57.372 --> 00:07:59.952 but declining, cash reserves enabled U.S. 00:08:00.282 --> 00:08:03.332 consumers to withstand costs associated with the level of 00:08:03.332 --> 00:08:05.422 inflation and rising interest rates. 00:08:05.812 --> 00:08:09.522 Credit card and auto delinquencies, however, increased in most banks 00:08:09.522 --> 00:08:11.642 in 20 23 and are increasing. 00:08:12.002 --> 00:08:15.912 More material credit deterioration is evident in banks with higher risk 00:08:15.912 --> 00:08:18.342 appetites and more nonprime strategies. 00:08:18.672 --> 00:08:22.822 Retail net charge-offs, primarily driven by credit cards, have increased 00:08:22.822 --> 00:08:24.892 steadily each quarter for the past year. 00:08:25.222 --> 00:08:28.442 The most vulnerable segments of households continue to be those in 00:08:28.442 --> 00:08:32.342 lower income brackets, on a fixed income, or more highly leveraged. 00:08:32.752 --> 00:08:36.022 Higher interest rates on new originations and upward adjustments 00:08:36.022 --> 00:08:39.662 on variable rate debt, along with the potential for declining asset 00:08:39.662 --> 00:08:43.702 values, could place additional pressure on certain consumer and mortgage 00:08:43.702 --> 00:08:45.812 borrower segments and loan vintages. 00:08:46.283 --> 00:08:50.643 The resumption of federal student loan payments in October 20 23 and the 00:08:50.643 --> 00:08:54.543 discontinuation of other government support programs pose uncertainty 00:08:54.543 --> 00:08:58.073 regarding the potential impacts on some borrowers’ ability to pay. 00:08:58.773 --> 00:09:03.093 The new Saving on Valuable Education (SAVE) program is anticipated to reduce 00:09:03.093 --> 00:09:07.503 student loan payment shock by limiting payments to 5 percent of discretionary 00:09:07.503 --> 00:09:09.553 income, increasing the amount of 00:09:09.906 --> 00:09:13.906 income considered non-discretionary, and accelerating loan forgiveness. 00:09:14.536 --> 00:09:17.546 Banks should evaluate the risk that consumers’ student loans 00:09:17.546 --> 00:09:21.186 payment resumption may impact repayment of their other bank loans. 00:09:21.656 --> 00:09:24.886 Additional considerations include the risk inherent in new loan 00:09:24.886 --> 00:09:28.436 applications where missed student loan payments will not be reported 00:09:28.436 --> 00:09:32.616 to the credit-reporting companies as delinquencies, and borrowers will not be 00:09:32.616 --> 00:09:34.666 considered in default for the next year. 00:09:35.053 --> 00:09:39.483 Residential real estate loan portfolios demonstrate satisfactory performance. 00:09:39.973 --> 00:09:44.473 Consumer home loans reflect sound underwriting; and overall portfolio risk 00:09:44.473 --> 00:09:48.333 metrics reflect satisfactory support from the level of homeowner equity. 00:09:48.813 --> 00:09:53.123 Stress testing vulnerable vintages, segments, and geographies, on variables 00:09:53.123 --> 00:09:57.513 such as unemployment, declining collateral values, and inflation impacts 00:09:57.513 --> 00:09:59.823 on disposable income, is an effective 00:10:00.305 --> 00:10:03.015 tool to identify weaker portfolio segments. 00:10:03.485 --> 00:10:07.445 If identified, weaker segments warrant monitoring, incremental adjustments 00:10:07.445 --> 00:10:11.285 to underwriting, and an emphasis on safe and sound principles in the 00:10:11.285 --> 00:10:15.515 execution of loss mitigation programs to provide prudent, affordable, and 00:10:15.515 --> 00:10:17.625 sustainable borrower payment assistance. 00:10:18.087 --> 00:10:22.427 Borrower payment assistance programs for retail loan products take many forms. 00:10:22.967 --> 00:10:26.987 Effective loss mitigation programs accurately address financial hardship 00:10:27.137 --> 00:10:30.817 and underwrite the loan to the borrower’s willingness and ability to pay the debt. 00:10:31.297 --> 00:10:35.367 Prudent programs verify the borrower’s sources of income, total debt, and 00:10:35.367 --> 00:10:38.977 contractual payments, which support affordability and should result in 00:10:38.977 --> 00:10:42.027 sustainability of the borrower’s ability to repay their debt. 00:10:42.559 --> 00:10:46.589 Loss mitigation programs based on unverified information and lacking 00:10:46.589 --> 00:10:50.279 sufficient repayment analysis are inappropriate, and reliance on 00:10:50.279 --> 00:10:53.859 extended amortization, extensions, and deferral of unpaid amounts 00:10:53.859 --> 00:10:57.829 reflect a borrower’s lack of repayment capacity and may not be in the best 00:10:57.829 --> 00:10:59.639 interest of the borrower or the bank. 00:11:00.179 --> 00:11:03.599 Imprudent loss mitigation programs can result in less effective 00:11:03.599 --> 00:11:05.269 risk oversight and reporting. 00:11:05.789 --> 00:11:09.259 Bank management should remain focused on accurate and timely risk 00:11:09.259 --> 00:11:13.239 identification utilizing delinquency reporting, risk rating, loss 00:11:13.239 --> 00:11:15.209 recognition, and financial reporting. 00:11:15.694 --> 00:11:16.474 Market Risk. 00:11:16.994 --> 00:11:20.964 The speed and magnitude of rising rates have materially influenced depositor 00:11:20.964 --> 00:11:24.924 behavior and rate sensitivity in direction and magnitude inconsistent 00:11:24.924 --> 00:11:26.514 with historic observations. 00:11:27.044 --> 00:11:30.604 Banks are facing significant deposit competition from higher-yielding 00:11:30.604 --> 00:11:34.404 choices as well as reduced broader market liquidity, which may 00:11:34.404 --> 00:11:37.884 further pressure banks’ deposit retention and growth strategies. 00:11:38.424 --> 00:11:41.704 Deposit competition has pushed rates higher and resulted in 00:11:41.704 --> 00:11:46.234 increasing usage of higher cost CDs, brokered deposits, and borrowings. 00:11:46.624 --> 00:11:50.804 Banks’ NIM could be further pressured from continued market liquidity contraction, 00:11:51.024 --> 00:11:55.624 high and steady or increasing short-term rates, and a continued increasing trend 00:11:55.624 --> 00:11:57.744 in deposit rates and funding costs. 00:11:58.153 --> 00:12:03.123 Deposits as a percentage of assets in O C C-supervised institutions stabilized 00:12:03.123 --> 00:12:07.353 at 79 percent through the third quarter of 2023 after trending down from a 00:12:07.353 --> 00:12:10.133 peak of 82 percent at year-end 2021. 00:12:10.703 --> 00:12:13.983 This stabilization was supported by increased brokered deposit 00:12:13.983 --> 00:12:15.613 and wholesale funding usage. 00:12:16.133 --> 00:12:20.963 Between year-end 2022 and September 30, 2023, borrowings in O C 00:12:20.963 --> 00:12:26.043 C-supervised institutions increased 172 billion dollars (29 percent) 00:12:26.043 --> 00:12:30.923 and brokered deposits increased 258 billion dollars (55 percent). 00:12:31.503 --> 00:12:34.233 Rising deposit rates and increased reliance on 00:12:34.660 --> 00:12:38.030 wholesale funding significantly increased funding costs through 00:12:38.030 --> 00:12:39.850 the third quarter of 2023. 00:12:40.300 --> 00:12:45.290 Banks with assets under 1 billion dollarshad a 91 basis point (131 00:12:45.290 --> 00:12:49.000 percent) increase in funding costs while banks with assets over 00:12:49.518 --> 00:12:53.778 1 billion dollars saw a 112 basis point (100 percent) increase. 00:12:54.318 --> 00:12:59.128 Increased funding costs observed in 2023 compressed NIMs in smaller institutions, 00:12:59.358 --> 00:13:04.188 despite rising asset yields, after significant NIM expansion in 2022. 00:13:04.738 --> 00:13:08.578 The median NIM (quarterly annualized) in banks with assets between 10 00:13:08.578 --> 00:13:13.228 billion dollars and 50 billion dollars declined 35 basis points to 3 point 00:13:13.228 --> 00:13:17.758 14 percent, while banks with assets less than 10 billion dollars saw a 00:13:17.758 --> 00:13:20.228 reduction of 22 basis points to 3. 00:13:20.768 --> 00:13:21.708 point 0 percent. 00:13:22.038 --> 00:13:26.048 Banks with assets greater than 50 billion dollars actually had a modest 00:13:26.048 --> 00:13:30.878 improvement of 6 basis points in the third quarter, bringing median NIM to 3.10 00:13:30.878 --> 00:13:35.948 percent and nearly back to the 3 point 12 percent observed at year-end 2022. 00:13:36.397 --> 00:13:40.797 Stress testing and sensitivity analyses of deposit assumptions remain critical 00:13:40.797 --> 00:13:45.057 given recent trends in deposit movement and rates as well as uncertainty regarding 00:13:45.057 --> 00:13:46.997 depositor behavior moving forward. 00:13:47.537 --> 00:13:50.777 Banks may experience continued pressure to raise deposit rates 00:13:50.777 --> 00:13:55.107 contemporaneously and at higher levels than forecasted relative to market rate 00:13:55.107 --> 00:13:57.497 changes to grow or retain deposits. 00:13:58.067 --> 00:14:02.317 These factors may continue to compress margins, elevate risk to earnings, and 00:14:02.317 --> 00:14:06.077 present new challenges for banks to model and project deposit rates and 00:14:06.077 --> 00:14:10.687 balances in both interest rate and liquidity risk stress testing scenarios. 00:14:10.837 --> 00:14:14.907 Inaccurate deposit assumptions will render model results unreliable and 00:14:14.907 --> 00:14:19.027 may mask banks’ true interest rate risk and liquidity risk profiles. 00:14:19.577 --> 00:14:23.777 Unreliable model projections and stresses may result in higher-than-forecast 00:14:23.777 --> 00:14:27.887 funding costs, potentially unexpected liquidity shortfalls, and 00:14:27.887 --> 00:14:29.857 imprecision in balance sheet hedging. 00:14:30.283 --> 00:14:34.493 Sound liquidity risk management, including processes that ensure sufficient 00:14:34.493 --> 00:14:38.403 committed capacity to meet contingent liquidity needs, remains critical. 00:14:39.043 --> 00:14:43.183 Asset liquidity stabilized in 2023 and has been buoyed by increased 00:14:43.183 --> 00:14:44.823 wholesale funding reliance. 00:14:45.423 --> 00:14:49.603 Unrealized losses in OCC-supervised institutions’ investment portfolios 00:14:49.603 --> 00:14:53.353 were negatively impacted by continued increases in the 10-year U.S. 00:14:53.593 --> 00:14:55.693 Treasury rates and remain a concern. 00:14:56.313 --> 00:15:00.043 The current elevated levels of bank investment portfolio depreciation 00:15:00.043 --> 00:15:04.033 could exacerbate risk exposure, particularly if security sales are 00:15:04.033 --> 00:15:06.093 required to meet funding outflows. 00:15:06.363 --> 00:15:10.773 Unrealized losses (as a percentage of amortized cost) in O C C-supervised 00:15:10.773 --> 00:15:14.333 institutions’ available for sale (AFS) portfolios increased in the 00:15:14.333 --> 00:15:19.063 third quarter of 2023 and remain elevated at 8 percent, while unrealized 00:15:19.063 --> 00:15:23.363 losses in held-to-maturity (HTM) portfolios increased to 16 percent. 00:15:23.993 --> 00:15:27.463 Unrealized investment portfolio losses highlight the importance of 00:15:27.463 --> 00:15:31.113 operational readiness to monetize securities in a timely manner in 00:15:31.113 --> 00:15:35.413 case liquidity needs arise, to avoid recognizing unrealized losses. 00:15:35.863 --> 00:15:40.803 Examples include repo lines, Federal Home Loan Bank (FHLB) capacity, and 00:15:40.803 --> 00:15:43.063 access to Federal Reserve facilities. 00:15:43.423 --> 00:15:46.933 Regular testing and capacity assessments will help ensure these 00:15:47.316 --> 00:15:48.906 sources remain accessible. 00:15:49.536 --> 00:15:54.036 This is particularly important for banks with large HTM holdings, as sale of 00:15:54.036 --> 00:15:58.106 these securities can taint the portfolio and lead to recognition of losses. 00:15:58.568 --> 00:16:00.998 Operational Risks: CYBERSECURITY 00:16:01.480 --> 00:16:05.810 Operational risk continues to be elevated as cyberattacks evolve and become more 00:16:05.810 --> 00:16:08.100 sophisticated and pervasive to the U.S. 00:16:08.300 --> 00:16:08.820 economy. 00:16:09.250 --> 00:16:12.950 Continuing cyberattacks and current geopolitical tensions highlight the 00:16:12.950 --> 00:16:16.550 importance of heightened threat monitoring and safeguarding against disruptive 00:16:16.550 --> 00:16:18.650 attacks targeting the financial sector. 00:16:19.200 --> 00:16:22.530 Over the past year, there has been an observed increase in distributed 00:16:22.530 --> 00:16:25.870 denial of service (DDoS) attacks against the financial sector. 00:16:26.350 --> 00:16:29.820 Some of the increase may be attributed to politically motivated attacks 00:16:30.050 --> 00:16:33.530 while others are financially driven, coupled with extortion demands. 00:16:33.980 --> 00:16:37.160 Ransomware actors continue to affect the sector by targeting 00:16:37.160 --> 00:16:38.750 banks and their third parties. 00:16:39.270 --> 00:16:43.030 These attacks have the potential to affect banks and market operations by 00:16:43.030 --> 00:16:47.640 rendering critical data inaccessible as well as by threatening the confidentiality 00:16:47.640 --> 00:16:49.700 of customer data through data leaks. 00:16:50.090 --> 00:16:53.080 Single cyber campaigns have demonstrated the ability to 00:16:53.080 --> 00:16:56.860 compromise hundreds of organizations and affect a significant number 00:16:57.371 --> 00:16:58.241 of consumers. 00:16:58.721 --> 00:17:02.271 Threat actors continue to leverage phishing emails and texts targeting 00:17:02.271 --> 00:17:05.861 employees and compromised credentials to gain access to networks 00:17:05.861 --> 00:17:07.631 through remote access solutions. 00:17:08.171 --> 00:17:12.211 Such unauthorized access would enable threat actors to conduct ransomware 00:17:12.211 --> 00:17:15.611 and other extortion campaigns that can affect bank customers. 00:17:16.171 --> 00:17:19.321 Malicious actors have also continued to use DDoS attacks 00:17:19.321 --> 00:17:20.941 to target the financial sector. 00:17:21.481 --> 00:17:25.371 Threat actors continue to exploit publicly known software vulnerabilities 00:17:25.371 --> 00:17:29.111 and weak authentication controls at targeted organizations, including 00:17:29.111 --> 00:17:31.311 banks and financial service providers. 00:17:31.601 --> 00:17:35.721 To mitigate against cyber risks, it is important for banks to adopt heightened 00:17:35.721 --> 00:17:39.451 threat and vulnerability monitoring processes and implement effective 00:17:39.451 --> 00:17:44.001 security measures, including the use of multifactor authentication (M F A), 00:17:44.001 --> 00:17:47.731 hardening of systems configurations, and timely patch management. 00:17:48.240 --> 00:17:51.050 The OCC continues to see cybersecurity incidents that 00:17:51.050 --> 00:17:55.460 exploit weak or poorly configured authentication controls and practices. 00:17:55.880 --> 00:18:00.480 Recent attacks suggest that banks using single-factor authentication or relying on 00:18:00.480 --> 00:18:05.440 weak security methods may face increased risk of unauthorized access to information 00:18:05.440 --> 00:18:10.110 systems, potential operational disruption, data compromise, or financial loss. 00:18:10.640 --> 00:18:14.420 The O C C encourages banks to conduct thorough risk assessments that 00:18:14.420 --> 00:18:16.460 include authentication practices. 00:18:16.860 --> 00:18:20.890 When consistently implemented, properly configured, and combined with other 00:18:20.890 --> 00:18:25.440 layered security controls, M F A can provide an enhanced level of protection 00:18:25.660 --> 00:18:27.980 and help prevent attacks on bank systems. 00:18:28.384 --> 00:18:31.284 INNOVATION AND ADOPTION OF NEW PRODUCTS AND SERVICES 00:18:31.738 --> 00:18:35.968 Banks continue to leverage new technology and innovative products and services 00:18:35.968 --> 00:18:39.098 to further their digitalization efforts and to meet evolving 00:18:39.098 --> 00:18:41.208 customer demand and expectations. 00:18:41.598 --> 00:18:45.478 Examples of innovations include faster and real-time payment products, 00:18:45.658 --> 00:18:49.268 increased use of mobile and digital technologies to deliver financial 00:18:49.268 --> 00:18:53.818 services, application programming interfaces, data aggregation services, 00:18:53.958 --> 00:18:56.348 AI, and contactless payment devices. 00:18:56.758 --> 00:19:00.038 While these products and services and their underlying technologies 00:19:00.038 --> 00:19:04.108 can offer many benefits to banks and their customers, they also contribute 00:19:04.108 --> 00:19:07.778 to a complex operating environment along with increasing compliance, 00:19:07.778 --> 00:19:10.298 reputational, strategic, and other risks. 00:19:10.678 --> 00:19:14.028 It is important to assess how technology can be leveraged to fuel 00:19:14.028 --> 00:19:18.298 rapid deposit outflows and how the use of social media and other digital 00:19:18.298 --> 00:19:20.588 channels may accelerate communications. 00:19:20.798 --> 00:19:24.488 Banks are also reminded to implement appropriate due diligence, change 00:19:24.488 --> 00:19:28.758 management, and risk management processes when considering changes to products, 00:19:28.808 --> 00:19:30.968 services, and operating environments. 00:19:31.412 --> 00:19:34.192 Banks have approached AI adoption cautiously, with 00:19:34.192 --> 00:19:35.842 a wide range of use cases. 00:19:36.422 --> 00:19:40.692 The use of AI has the potential to reduce costs and increase efficiencies; 00:19:41.062 --> 00:19:45.182 improve products, services, and performance; strengthen risk management; 00:19:45.502 --> 00:19:49.262 and expand access to credit and other banking products and services. 00:19:49.922 --> 00:19:53.452 AI systems may, however, present particular challenges related 00:19:53.452 --> 00:19:54.972 to bias and discrimination. 00:19:55.502 --> 00:19:59.212 For example, these systems may perpetuate or exacerbate the results 00:19:59.212 --> 00:20:03.052 of historical discrimination if they are improperly trained or used 00:20:03.052 --> 00:20:07.282 with data sets that reflect biases or past discrimination practices. 00:20:07.702 --> 00:20:10.702 Use of generative AI is becoming more accessible with the 00:20:10.732 --> 00:20:14.062 introduction of commercially available large language models. 00:20:14.492 --> 00:20:18.272 Like with all new or expanded products, services, and relationships, 00:20:18.312 --> 00:20:21.972 appropriate risk management processes, including due diligence 00:20:21.972 --> 00:20:23.762 and change management, are needed. 00:20:24.260 --> 00:20:28.460 Banks and service providers continue to face challenges with maintaining legacy 00:20:28.460 --> 00:20:32.970 technology architectures while responding to increasing digitalization demands. 00:20:33.470 --> 00:20:37.370 It is important for banks to maintain appropriate operational resilience for 00:20:37.370 --> 00:20:41.450 on-premises and critical third-party technology architecture, commensurate 00:20:41.450 --> 00:20:45.870 with the size and complexity of products, services, and operations being supported. 00:20:46.440 --> 00:20:50.320 An effective operational resilience strategy can enhance a bank’s ability 00:20:50.320 --> 00:20:54.650 to mitigate disruption from all hazards, including cyber threats, and other 00:20:54.650 --> 00:20:56.860 technology and operational outages. 00:20:57.244 --> 00:21:01.354 Sound risk management practices can help safeguard against fraud, financial 00:21:01.354 --> 00:21:03.284 crimes, and operational errors. 00:21:03.854 --> 00:21:07.424 While traditional payment channels, such as checks and wire transfers, 00:21:07.424 --> 00:21:11.634 continue to be targeted, increasing digitalization of products and services 00:21:11.634 --> 00:21:16.654 can also heighten risk of fraud and error, including fraud targeting P2P 00:21:16.704 --> 00:21:18.674 and other faster payment platforms. 00:21:18.994 --> 00:21:22.854 While P2P payment platforms can provide enhanced capabilities and 00:21:22.854 --> 00:21:27.074 convenience to consumers for managing payments, the faster and streamlined 00:21:27.074 --> 00:21:30.604 payment capabilities and the irreversible and irrevocable nature 00:21:30.604 --> 00:21:33.934 of these payments have also been used to perpetuate consumer fraud. 00:21:34.434 --> 00:21:38.474 Banks can aid customers by strengthening controls, educating customers on 00:21:38.474 --> 00:21:42.704 potential scams, and enhancing internal fraud monitoring capabilities. 00:21:43.084 --> 00:21:46.944 Examiners will continue to assess how banks are managing these and other 00:21:46.944 --> 00:21:51.254 risks related to changes in operating environments driven by these innovations. 00:21:51.648 --> 00:21:55.898 The O C C continues to approach crypto-asset products, services, and 00:21:55.898 --> 00:22:00.328 activities cautiously for a variety of reasons, including high volatility, 00:22:00.568 --> 00:22:04.578 high-risk lending, excessive leverage, interconnectedness, concentration 00:22:04.578 --> 00:22:08.018 within the crypto industry, and lack of comprehensive regulation. 00:22:08.558 --> 00:22:12.908 Banks are reminded to follow the process outlined in O C C Interpretative Letter 00:22:12.908 --> 00:22:18.108 1179 before engaging in permissible crypto-asset-related activities. 00:22:18.645 --> 00:22:21.825 THIRD-PARTY RISK MANAGEMENT AND OTHER OPERATIONAL RISKS 00:22:22.243 --> 00:22:26.053 Digitalization and technological innovation continue to advance the trend 00:22:26.053 --> 00:22:30.823 of banks outsourcing technology operations and banks entering partnerships or other 00:22:30.823 --> 00:22:35.083 arrangements with third parties, including fintech firms, to deliver innovative 00:22:35.083 --> 00:22:36.963 financial products and services. 00:22:37.203 --> 00:22:40.773 For example, increasing adoption of cloud services in the financial 00:22:40.773 --> 00:22:43.193 sector, as noted in a recent U.S. 00:22:43.433 --> 00:22:47.953 Department of the Treasury report, is allowing banks to gain efficiencies, but 00:22:47.953 --> 00:22:52.883 also can present risk if not implemented properly.The complexity of bank-fintech 00:22:52.883 --> 00:22:56.473 partnerships is also increasing as the volume of new entrants within the 00:22:56.473 --> 00:22:58.713 fintech ecosystem continues to grow. 00:22:59.243 --> 00:23:03.413 Effective management and oversight are important for third-party relationships. 00:23:03.663 --> 00:23:06.813 Third- party risk management processes should be commensurate with the 00:23:06.813 --> 00:23:10.783 size, complexity, and risk profile of the bank and with the nature 00:23:10.783 --> 00:23:12.333 of the third-party relationship. 00:23:12.903 --> 00:23:16.523 It is also important for banks to engage in more rigorous oversight of 00:23:16.583 --> 00:23:20.663 third-party relationships that support higher-risk and critical activities. 00:23:21.283 --> 00:23:24.683 In addition, it is important for banks to maintain talent management 00:23:24.683 --> 00:23:28.783 strategies to ensure sufficient resources and subject matter expertise 00:23:28.783 --> 00:23:30.583 to implement critical controls. 00:23:31.003 --> 00:23:35.153 Given demand for staff with specialized experience and technical expertise, 00:23:35.443 --> 00:23:39.233 it may sometimes be necessary for banks to engage with a third party. 00:23:39.728 --> 00:23:43.688 Compliance Risk: BANK SECRECY ACT/ANTI-MONEY LAUNDERING AND 00:23:43.688 --> 00:23:45.708 OFFICE OF FOREIGN ASSETS CONTROL 00:23:46.173 --> 00:23:47.293 COMPLIANCE RISKS 00:23:47.717 --> 00:23:51.937 Banks continue to adopt or consider fintech relationships related to product 00:23:51.937 --> 00:23:56.307 and service offerings, and it is import that they effectively manage the resulting 00:23:56.307 --> 00:24:00.337 operational and compliance risks, including third-party risk management. 00:24:00.807 --> 00:24:04.447 It is important that banks understand the benefits and risks associated 00:24:04.447 --> 00:24:08.607 with each third-party relationship, with particular focus on relationships 00:24:08.607 --> 00:24:12.707 that involve higher-risk or critical activities, and that they enter into 00:24:12.707 --> 00:24:16.657 effective contracts addressing the potential for default and termination. 00:24:17.017 --> 00:24:20.247 It is also important for banks to identify potentially nested 00:24:20.247 --> 00:24:24.357 relationships where a fintech firm may be providing services to other fintech 00:24:24.357 --> 00:24:26.347 firms without appropriate controls. 00:24:26.747 --> 00:24:30.527 As the range of payment methods and their accessibility continue to expand 00:24:30.527 --> 00:24:34.477 and evolve, for example with the launch of instant payments via FedNow, it 00:24:34.477 --> 00:24:38.397 is important that banks continuously evaluate their BSA/AML risks and 00:24:38.397 --> 00:24:42.687 corresponding controls to keep pace with new or changing risk profiles. 00:24:43.153 --> 00:24:47.363 While banks continue to expand their digital and electronic products, services, 00:24:47.363 --> 00:24:51.523 and capabilities, they should be aware of related risks, including a recent 00:24:51.523 --> 00:24:55.583 alert issued by the Financial Crimes Enforcement Network (FinCEN) highlighting 00:24:55.583 --> 00:25:00.683 a prominent virtual currency investment scam known as “pig butchering.” Banks 00:25:00.683 --> 00:25:04.443 also should remain vigilant against traditional financial crime risks. 00:25:04.783 --> 00:25:08.383 There have been significant increases in fraud, as highlighted in both 00:25:08.383 --> 00:25:12.033 a FinCEN alert on the nationwide surge in mail theft-related check 00:25:12.033 --> 00:25:16.143 fraud schemes, and a FinCEN analysis identifying threat patterns and 00:25:16.143 --> 00:25:19.883 trends related to business email compromise in the real estate sector. 00:25:20.393 --> 00:25:25.263 FinCEN also has noted increases in payroll tax evasion and worker’s compensation 00:25:25.263 --> 00:25:26.973 fraud in the construction sector. 00:25:27.420 --> 00:25:31.870 Suspicious activity report (SAR) data trends reflect significant increases 00:25:31.870 --> 00:25:33.870 in SAR filings related to fraud. 00:25:34.500 --> 00:25:38.440 Effective processes to prevent, identify, and file SARs in a timely 00:25:38.440 --> 00:25:42.740 manner, including fraudulent activity, remain important to protect financial 00:25:42.740 --> 00:25:46.630 institutions, consumers, and the financial system, as indicated 00:25:46.630 --> 00:25:50.420 by the fact that fraud is one of FinCEN’s National AML/CFT Priorities. 00:25:50.830 --> 00:25:54.310 Banks’ responsibilities under the current Customer Due Diligence and 00:25:54.310 --> 00:25:58.400 Beneficial Ownership Rule and other existing BSA requirements remain 00:25:58.400 --> 00:26:02.810 unchanged, pending the issuance of changes to those regulatory requirements 00:26:02.810 --> 00:26:05.170 as required by the AML Act of 2020. 00:26:05.623 --> 00:26:07.523 CONSUMER COMPLIANCE AND COMMUNITY 00:26:07.967 --> 00:26:10.577 REINVESTMENT ACT/FAIR LENDING (CRA/FL) RISKS 00:26:10.969 --> 00:26:14.319 Banks continue to face heightened attention and focus on ensuring 00:26:14.349 --> 00:26:18.559 equal access to credit, and fair and consistent treatment of consumers as 00:26:18.559 --> 00:26:22.419 they adapt to changing customer needs and preferences related to product, 00:26:22.449 --> 00:26:24.649 service, and delivery channel offerings. 00:26:25.089 --> 00:26:28.549 Risks are compounded if changes are not delivered or implemented 00:26:28.549 --> 00:26:30.429 in a fair or equitable manner. 00:26:31.019 --> 00:26:34.369 Banks’ compliance risk management frameworks should be commensurate 00:26:34.369 --> 00:26:38.589 with their existing risk profiles and capable of efficiently and effectively 00:26:38.589 --> 00:26:40.679 supporting risk profile changes. 00:26:41.019 --> 00:26:45.039 Additionally, as interest rates continue to rise, banks may experience 00:26:45.039 --> 00:26:48.269 an increase in relief requests under the Servicemembers Civil 00:26:48.269 --> 00:26:51.999 Relief Act on certain obligations or liabilities incurred before the 00:26:51.999 --> 00:26:54.279 servicemember entered military service. 00:26:54.759 --> 00:26:58.269 In particular, borrowers may seek relief for adjustable-rate credit 00:26:58.269 --> 00:27:02.049 products such as credit cards and for eligible auto payments. 00:27:02.448 --> 00:27:08.278 On October 24, 2023, the O C C, the Federal Reserve, and the F D I C issued 00:27:08.278 --> 00:27:12.718 a final rule to strengthen and modernize regulations implementing the C R A. 00:27:13.238 --> 00:27:17.578 The effective date of the rule is April 1, 2024, with key provisions of 00:27:17.578 --> 00:27:23.328 the final rule going into effect on January 1, 2026, and January 1, 2027. 00:27:23.858 --> 00:27:27.428 It is important for banks to plan for changes that become effective on 00:27:27.458 --> 00:27:32.478 April 1, 2024, and to implement change management processes as appropriate 00:27:32.478 --> 00:27:36.778 to address the potential impact of the rule on bank systems and resources. 00:27:37.276 --> 00:27:39.046 Climate-Related Financial Risk 00:27:39.573 --> 00:27:42.923 FINAL INTERAGENCY PRINCIPLES FOR CLIMATE-RELATED FINANCIAL 00:27:42.923 --> 00:27:44.433 RISK MANAGEMENT FOR LARGE 00:27:44.874 --> 00:27:46.344 FINANCIAL INSTITUTIONS 00:27:46.786 --> 00:27:52.926 On October 24, 2023, the O C C, F D I C, and Federal Reserve issued final 00:27:52.926 --> 00:27:56.616 Interagency Principles for Climate- Related Financial Risk Management 00:27:56.616 --> 00:28:00.186 for Large Financial Institutions that provide a high-level framework 00:28:00.186 --> 00:28:03.666 for the safe and sound management of exposures to climate-related 00:28:03.666 --> 00:28:07.426 financial risk for financial institutions with total consolidated 00:28:07.426 --> 00:28:09.666 assets over 100 billion dollars. 00:28:10.036 --> 00:28:14.296 The principles support large financial institutions’ efforts to focus on key 00:28:14.296 --> 00:28:18.566 aspects of climate-related financial risk management, providing a high-level 00:28:18.566 --> 00:28:22.386 framework for climate- related financial risk management consistent with the 00:28:22.386 --> 00:28:24.816 agencies’ existing rules and guidance. 00:28:25.238 --> 00:28:29.398 OBSERVATIONS OF LARGE BANKS’ MANAGEMENT OF CLIMATE-RELATED FINANCIAL RISK 00:28:29.907 --> 00:28:34.837 As noted in our Spring 2023 Semiannual Risk Perspective, the O C C has been 00:28:34.837 --> 00:28:39.017 conducting supervision activities at its largest banks (those with over 100 00:28:39.017 --> 00:28:42.807 billion dollars in total assets) to understand the banks’ climate- related 00:28:42.807 --> 00:28:44.927 financial risk management programs. 00:28:45.537 --> 00:28:48.727 This work is well underway and will continue in 2024. 00:28:49.287 --> 00:28:52.637 As we stated in the spring, the large banks have been making progress 00:28:52.637 --> 00:28:55.917 to incorporate climate-related financial risks in their risk 00:28:55.917 --> 00:28:57.907 management frameworks and policies. 00:28:58.487 --> 00:29:02.437 At the same time, the large banks overall have significant additional work to 00:29:02.437 --> 00:29:04.747 do to move those programs to maturity. 00:29:05.206 --> 00:29:06.936 Observations to date include: 00:29:07.462 --> 00:29:11.542 Efforts to incorporate climate-related financial risk in strategic planning 00:29:11.542 --> 00:29:13.862 remain in the early stages of development. 00:29:14.305 --> 00:29:17.215 Most of these banks are also still in the early stages of 00:29:17.305 --> 00:29:20.795 integrating climate-related financial risk into their broader risk 00:29:20.835 --> 00:29:24.995 appetites, and some have developed quantitative risk appetite metrics. 00:29:25.425 --> 00:29:29.585 Banks are reporting on climate-related financial risk to senior management and 00:29:29.585 --> 00:29:33.585 the board and indicated that reporting will become more detailed moving forward. 00:29:34.119 --> 00:29:37.969 Banks continue to face challenges and limitations on obtaining granular 00:29:37.969 --> 00:29:41.289 data for their climate-related financial risk analysis. 00:29:41.750 --> 00:29:45.520 Banks have generally developed or are planning to implement climate-related 00:29:45.520 --> 00:29:49.480 credit risk assessments to evaluate borrowers’ and clients’ exposures 00:29:49.480 --> 00:29:51.570 to high-risk sectors and industries. 00:29:52.091 --> 00:29:55.511 Banks are in the very early stages of understanding the impacts of 00:29:55.511 --> 00:29:59.971 climate change and ways to mitigate climate-related financial risk on low- and 00:29:59.971 --> 00:30:01.881 moderate-income communities they serve. 00:30:02.451 --> 00:30:05.681 Bank management teams generally have focused their initial work on 00:30:05.681 --> 00:30:09.061 the physical risks (e.g., flooding) of residential real estate. 00:30:09.513 --> 00:30:13.503 This concludes the O C C’s Risk Perspective Report Section 4. 00:30:13.926 --> 00:30:18.086 If your Credit union could use assistance with your exam, reach out to Mark Treichel 00:30:18.086 --> 00:30:20.676 on LinkedIn, or at mark Treichel dot com. 00:30:21.216 --> 00:30:23.856 This is Samantha Shares and we Thank you for listening.